Financially motivated groups like ShinyHunters and Scattered LAPSUS$ Hunters are exploiting federated SSO and SaaS trust relationships via vishing and OAuth abuse to gain persistent access, exfiltrate data at scale, and conduct delayed extortion against organizations.
Overview
Recent activity attributed to ShinyHunters, Scattered Spider, and the self-branded “Scattered LAPSUS$ Hunters (SLH)” highlights a sustained shift toward identity-driven intrusions targeting SaaS platforms such as Salesforce, Okta, Microsoft Entra, Google SSO, and Zendesk. These campaigns rely on vishing and real-time social engineering to coerce users into completing legitimate authentication and OAuth authorization flows, enabling attackers to gain persistent access without exploiting software vulnerabilities. The threat is significant because a single successful interaction with an employee can provide access to multiple downstream SaaS platforms through federated SSO, rapidly expanding the blast radius of a compromise. Once access is obtained, attackers enumerate connected applications, exfiltrate large volumes of customer and operational data, and later issue extortion demands, sometimes months after the initial intrusion. This activity is occurring in the wild and has impacted multiple organizations across industries, demonstrating that trust workflows and human behavior are the primary attack surface rather than platform flaws.
Key Findings:
- Federated identity is the primary attack surface: These campaigns consistently bypass technical perimeter controls by using vishing and real-time social engineering to drive victims through legitimate sign-in and OAuth authorization flows, creating “valid” access without exploiting platform vulnerabilities.
- SSO creates an outsized blast radius: A single compromised user or support workflow can cascade across multiple downstream SaaS platforms (Salesforce, Zendesk, and others) via federated SSO, enabling rapid privilege expansion and broad data access.
- Abuse blends into normal operations: Attackers rely on legitimate OAuth grants, session persistence, and standard SaaS APIs to enumerate connected apps and perform bulk exports, which often evades monitoring that prioritizes failed logins or malware-based signals.
- Extortion and branding amplify impact: The “Scattered LAPSUS$ Hunters” label functions as a federated reputation layer that increases coercion and confusion, with public claims and delayed extortion sometimes occurring months after initial access—complicating attribution, response, and customer communications.
- Immediate Actions: Restrict Salesforce connected-app/OAuth authorization to an explicit allowlist and trigger immediate review of any new app authorization or token grant events. Harden help-desk and support workflows with mandatory secondary verification for account recovery, resets, and sensitive access actions to neutralize vishing-driven impersonation.
1.0 Threat Overview
Scattered LAPSUS$ Hunters emerged publicly in early August 2025 as a hybrid brand that appropriates naming and reputational elements from Scattered Spider, ShinyHunters, and LAPSUS$. Trustwave SpiderLabs assesses SLH as a situational alliance or brand container rather than a formal merger, with Telegram serving as the primary platform for narrative construction, coordination, and extortion signaling. Channels associated with SLH have been repeatedly removed and re-created, reflecting both platform moderation and the group’s emphasis on persistent public presence.
Parallel reporting throughout 2025 and early 2026 documents ShinyHunters’ evolution from mass data theft toward targeted cloud and SaaS extortion, with Salesforce repeatedly identified as a core objective. Incidents such as the disputed Resecurity “breach” illustrate how the group emphasizes public claims and coercive narratives, even when the underlying access involves synthetic or honeypot data, reinforcing that perception management is a core component of operations. Additionally, ShinyHunters and associated actors are conducting human-operated social engineering campaigns that exploit trust in identity and support workflows to access enterprise SaaS environments. These campaigns do not rely on vulnerabilities in Salesforce, Okta, Microsoft, Google, or Zendesk; instead they manipulate users into authorizing access or completing authentication on behalf of the attacker. Once inside, the attackers leverage legitimate access paths to harvest data at scale and monetize intrusions through extortion. The SLH branding layer adds reputational leverage and visibility, enabling multiple actors to claim affiliation and amplify perceived impact.
1.1 Threat Actor Breakdown
LAPSUS$ is included in this section for contextual purposes only. While LAPSUS$ was an active and distinct cybercriminal group during 2021–2022, it is assessed as largely disrupted following law enforcement action. References to LAPSUS$ within the “Scattered LAPSUS$ Hunters” label reflect reputational reuse rather than operational continuity. There is no evidence that original LAPSUS$ operators are directly conducting the Salesforce or SaaS-focused campaigns described in this report.
The activity described in this report is not driven by a single, unified threat actor, but by a combination of operational groups and a federated branding construct. ShinyHunters and Scattered Spider are responsible for the execution of social engineering, identity compromise, and SaaS data theft, while the “Scattered LAPSUS$ Hunters” label functions primarily as a public-facing identity used to amplify extortion pressure and obscure attribution. This separation between execution and branding is a defining characteristic of the campaign.
ShinyHunters appears to play a central role in Salesforce-focused operations, demonstrating a consistent pattern of vishing-led access, OAuth abuse, and delayed extortion. Scattered Spider exhibits overlapping tradecraft, particularly around identity compromise and helpdesk impersonation, and is assessed as a likely collaborator or shared-resource peer rather than a subordinate entity. The SLH designation, meanwhile, operates as a narrative container that aggregates reputational capital from multiple well-known groups, increasing visibility and coercive leverage without clear evidence of centralized command or control.
Understanding these roles is critical for incident response and threat assessment. Public breach claims associated with the SLH label may not accurately reflect the scope or impact of an intrusion, and attribution should be based on observed tradecraft and telemetry rather than branding alone. Organizations responding to incidents linked to this ecosystem should therefore focus on identity abuse patterns and access pathways, rather than attempting to attribute activity solely based on actor naming.
2.0 Conditions Enabling Compromise
ShinyHunters’ Salesforce intrusions do not rely on software vulnerabilities or exploitation of platform flaws. Instead, successful compromise depends on a combination of identity trust assumptions, OAuth governance gaps, and human susceptibility to social engineering. When these conditions are present, attackers can obtain persistent, legitimate access to Salesforce environments without triggering traditional security controls, enabling large-scale data exfiltration and delayed monetization.
3.0 Historical Exploit Timeline
4.0 Risk and Impact
The risk posed by activity associated with ShinyHunters, Scattered Spider, and the Scattered LAPSUS$ Hunters brand is high, as it exploits legitimate identities and SaaS trust mechanisms rather than software vulnerabilities. By leveraging vishing, OAuth authorization, and federated SSO access, attackers can obtain persistent, authenticated access to Salesforce and other connected platforms while evading traditional perimeter and endpoint controls. Successful compromise enables large-scale exfiltration of sensitive customer, financial, and operational data, often without immediate detection. The impact extends beyond initial data theft, as delayed extortion campaigns, public breach claims, and data resale can amplify regulatory exposure, reputational damage, and financial loss months after the intrusion. As these campaigns target widely adopted SaaS platforms and customer support systems, a single compromised user or workflow can result in disproportionate downstream impact across the organization and its customer base.
5.0 Recommendations for Mitigation
To reduce exposure to vishing-led identity compromise and SaaS data theft associated with ShinyHunters, Scattered Spider, and the SLH ecosystem, organizations should implement layered controls that address both human trust exploitation and abuse of legitimate SaaS authorization mechanisms.
5.1 Reinforce employee awareness around vishing and IT impersonation
- Conduct targeted awareness messaging that explicitly warns employees and help-desk staff that IT or security teams will never request MFA approvals, OAuth app authorization, or software installation over the phone. Emphasize escalation procedures for suspicious calls rather than compliance under urgency.
5.2 Lock down Salesforce OAuth and connected app authorization workflows
- Restrict Salesforce-connected app installations and OAuth device flow usage to an explicit administrative allowlist. Disable end-user app self-authorization where possible, and routinely audit connected apps for excessive scopes, such as refresh tokens and full API access. Any newly authorized app should be treated as a high-risk event requiring immediate review.
5.3 Implement identity-centric detection for “legitimate but malicious” access patterns
- Shift detection logic from failed authentication to successful but anomalous behavior, including MFA success immediately followed by new OAuth app approval, bulk API exports, or off-hours Salesforce data access. Correlate identity events with SaaS telemetry to identify abuse of valid sessions rather than intrusion attempts.
5.4 Harden help-desk and support platform workflows as Tier-1 attack surfaces
- Treat Zendesk and similar customer support platforms as privileged systems. Limit which roles can process account recovery, credential resets, or sensitive attachments; require secondary verification for administrative actions; and monitor for fraudulent ticket submissions designed to deliver malware or harvest credentials.
5.5 Proactively disrupt attacker credibility through domain and infrastructure monitoring
- Monitor for and rapidly block look-alike domains impersonating Salesforce, Zendesk, or internal IT portals. Early detection of typosquatted infrastructure can disrupt vishing and phishing pretexts before employees are contacted, reducing the success rate of social engineering campaigns.
6.0 Hunter Insights
Federated SaaS intrusions tied to ShinyHunters, Scattered Spider, and the Scattered LAPSUS$ Hunters brand are likely to solidify into a mature “identity‑first” access and extortion ecosystem over the next 12–24 months, with SSO and support platforms at the center rather than traditional perimeter exploits. Expect expansion of real‑time phishing and vishing kits against Okta, Entra, and Google SSO, broader targeting of SaaS platforms like Salesforce, Zendesk, Gainsight, and similar CX/CRM ecosystems, and more frequent use of federated branding (such as SLH) to market “access‑as‑a‑service” and amplify coercive pressure while obscuring which underlying crews actually executed the intrusion. These actors will likely refine their tradecraft around OAuth and delegated flows, insider facilitation, AI‑assisted voice social engineering, and infrastructure camouflage (rapidly rotating but thematically consistent domains and messaging channels), making it harder for defenders to distinguish malicious but valid logins and data exports from normal operations.
For defenders, this trajectory means shifting cyber threat intelligence and detection priorities from single‑platform compromise toward the whole identity and SaaS trust chain. High‑value collection and monitoring areas include: federated‑brand infrastructure and personas rather than group names alone; identity‑centric precursors like risky OAuth grants, anomalous but successful MFA and SSO events, and first‑time bulk exports from SaaS APIs; and the Com–adjacent social and extortion channels that signal upcoming campaigns and narrative manipulation, including exaggerated or partially fabricated breach claims. Organizations should plan on multi‑tenant, customer‑impact scenarios as the default outcome of a single identity compromise, treat help‑desk and customer support platforms as Tier‑1 assets, and build playbooks that account for long‑tail extortion and public signaling well after the initial intrusion window.
